refactor(config): remove legacy config reference handling and streamline YAML management

- Deleted legacy config reference handling functions and related migration scripts to simplify the codebase.
- Updated documentation to reflect the removal of legacy YAML paths and configurations.
- Adjusted existing YAML management processes to ensure compatibility with the new mustache-style syntax.
- Removed tests related to legacy config references, focusing on current functionality and ensuring clarity in the testing suite.

packages/server/test/config-refs-smoke.js

@@ -2,8 +2,7 @@ import { migrate, db } from "../db.js";
 import { upsertSecret, deleteSecret } from "../secrets-store.js";
 import { deleteVariable, upsertVariable } from "../variables-store.js";
 import { Secret } from "../secret-value.js";
-import { parseLegacyConfigRef, resolveConfigRefs } from "../config-refs.js";
-import { rewriteLegacyConfigRefsInText } from "../config-ref-rewrite.js";
+import { resolveConfigRefs } from "../config-refs.js";
 
 await migrate();
 
@@ -27,50 +26,17 @@ async function assertRejects(fn, match) {
 const owner = "config_refs_smoke_owner";
 const ctx = { owner, workflowKey: `${owner}/config-refs-smoke.yaml`, context: {}, data: {} };
 
-{
-  const rewritten = rewriteLegacyConfigRefsInText(
-    'url: $VAR_ntfy\ntoken: $SECRET_tok\nid: $CONTEXT_user',
-  );
-  assert(rewritten.changed, "rewrite detects legacy refs");
-  assert(
-    rewritten.text.includes("{{ vars.ntfy }}") &&
-      rewritten.text.includes("{{ secrets.tok }}") &&
-      rewritten.text.includes("{{ context.user }}"),
-    "rewrite maps prefixes",
-  );
-  assert(!rewriteLegacyConfigRefsInText("passwordSecret: gmail_app").changed, "bare names untouched");
-}
-
-assert(parseLegacyConfigRef("$VAR_ntfy_url")?.kind === "var", "legacy var parse");
-assert(parseLegacyConfigRef("$SECRET_x")?.kind === "secret", "legacy secret parse");
-assert(parseLegacyConfigRef("$CONTEXT_token")?.kind === "context", "legacy context parse");
-assert(parseLegacyConfigRef("{{ vars.x }}") == null, "mustache is not legacy");
-assert(parseLegacyConfigRef("Bearer $SECRET_x") == null, "mid-string not whole-value legacy");
-
 {
   const literal = await resolveConfigRefs("password123", ctx);
   assert(literal === "password123", "literal passthrough");
   const unknown = await resolveConfigRefs("$FOO_bar", ctx);
   assert(unknown === "$FOO_bar", "$FOO_bar stays literal");
   const embedded = await resolveConfigRefs("Bearer $SECRET_x", ctx);
-  assert(embedded === "Bearer $SECRET_x", "mid-string legacy stays literal");
+  assert(embedded === "Bearer $SECRET_x", "mid-string stays literal");
   const number = await resolveConfigRefs(42, ctx);
   assert(number === 42, "number passthrough");
 }
 
-await assertRejects(
-  () => resolveConfigRefs("$VAR_ntfy_channel", ctx),
-  "removed",
-);
-await assertRejects(
-  () => resolveConfigRefs("$SECRET_tok", ctx),
-  "use {{ secrets.tok }}",
-);
-await assertRejects(
-  () => resolveConfigRefs("$CONTEXT_token", ctx),
-  "use {{ context.token }}",
-);
-
 const created = [];
 try {
   const secret = await upsertSecret({

packages/server/test/owner-migrate-smoke.js

@@ -1,30 +0,0 @@
-import { rewriteLegacyConfigRefsInText } from "../config-ref-rewrite.js";
-import { migrateDefaultOwnerIfNeeded } from "../owner-migrate.js";
-import { migrate, db } from "../db.js";
-
-function assert(cond, msg) {
-  if (!cond) throw new Error(msg);
-}
-
-{
-  const { text, changed } = rewriteLegacyConfigRefsInText(
-    "a: $VAR_x\nb: $SECRET_y\nc: $CONTEXT_z\nd: passwordSecret: gmail_app",
-  );
-  assert(changed, "detects legacy");
-  assert(text.includes("{{ vars.x }}"), "var rewrite");
-  assert(text.includes("{{ secrets.y }}"), "secret rewrite");
-  assert(text.includes("{{ context.z }}"), "context rewrite");
-  assert(text.includes("passwordSecret: gmail_app"), "bare secret name untouched");
-}
-
-await migrate();
-const first = await migrateDefaultOwnerIfNeeded();
-const second = await migrateDefaultOwnerIfNeeded();
-assert(second.secrets.moved === 0, "second pass moves no secrets");
-assert(second.runs.moved === 0, "second pass moves no runs");
-await db.destroy();
-
-console.log("owner-migrate smoke passed", {
-  firstSecretsMoved: first.secrets.moved,
-  secondSecretsMoved: second.secrets.moved,
-});